Experimental quantum key distribution based on a Bell test 
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We report on a complete free-space field implementation of a modified Ekert9f protocol for quan- 
tum key distribution using entangled photon pairs. For each photon pair we perform a random 
choice between key generation and a Bell inequality. The amount of violation is used to determine 
the possible knowledge of an eavesdropper to ensure security of the distributed final key. 



Introduction. Proposals for quantum key distribution 
(QKD) were first published over two decades ago 
In particular, the protocol of Bennett and Brassard in 
1984 (BB84) sought to distribute a random encryption 
key via correlated polarization states of single photons 
P, Its strength was derived from the no-cloning 
theorem [3, IB] which states that the state of a single 
quantum system cannot be copied perfectly. A measure- 
ment attempt on the distributed key is revealed as errors 
in the expected correlation of the measurement results. 
BB84 must treat all noise as evidence of an eavesdropper. 
Whether a completely secure key can then be distilled 
after error correction depends only on the fraction of 
errors in the initial key. 

The 'quantum' nature of QKD was explored from a dif- 
ferent angle in 1991 when Ekert proposed an implementa- 
tion using non-local correlations between maximally en- 
tangled photon-pairs The quality of entanglement 
between a photon-pair can be measured by the degree of 
violation of a Bell inequality [sj. Maximally entangled 
photon-pairs have perfect correlations in their polariza- 
tion states, and violate the Clauser-Horne-Shimony-Holt 
(CHSH) version P| of this inequality with the maximum 
value. The defining feature in Ekert91 is the suggestion 
to use the degree of violation of the CHSH inequality as 
a test of security. This conjecture is related to the con- 
cept later known as the monogamy of entanglement [lo| : 
the entanglement between two systems decreases when a 
third system (for example, the measurement apparatus 
of an eavesdropper) interacts with the pair. 

Although BB84 and Ekert91 utilize different aspects of 
quantum mechanics, once one writes down explicitly the 
expected qubit states and the measurements that should 
be performed, the two protocols turn out to generate 



the same set of correlations [ll|. When these calcula- 
tions were extended to include error correction and pri- 
vacy amplification, a quantitative link was found between 
Eve's information (assuming individual attacks) and the 
amount of violation of the CHSH inequality [ij], thus 
vindicating Ekert's intuition. BB84 and Ekert91 came 
to be considered as fully equivalent. In this perspec- 
tive, the choice between a prepare-and-measure and an 



entanglement-based implementation is dictated only by a 
balance of practical benefits. For instance, BB84 involves 
an active choice when encoding the logical bits and 
1 into the polarization states, requiring a trusted high- 
bandwidth random number source ,13l |: in comparison, 
no active choice is necessary with entanglement-based 
QKD. Besides its ability to remove the need for ran- 
dom number generators 14], technical difficulties related 
to the lack of practical true single photon sources can 
be avoided. The price of entanglement-based QKD is a 
lower key generation rate due to the limited brightness of 
contemporary entangled photon-pair sources when com- 
pared with faint coherent pulse approximations of single 
photon sources. 

Recently two theoretical developments pointed to the 
fact that BB84 and Ekert91 may not be equivalent after 
all. The first such development are the proofs of uncon- 



ditional security developed by Koashi and Preskill [15 1 
and improved by Ma, Fung and Lo fl6i|. These authors 
proved that the security of entanglement-based imple- 
mentations can be based on the sole knowledge of the 
error rate, because this quantity already contains infor- 
mation about the imperfection of the source — while 
such imperfections (e.g. the photon-number statistics, or 
spectral distinguishability of different letters jl3|) must 
be carefully taken into account in prepare-and-measure 
schemes [ll, [13, 0] • The second development is due to 
Acfn and coworkers plj. These authors went back to 
Ekert's original idea of basing the security only on the 
combined correlation function S for violating CHSH and 
derived the formula 



I Eve 



= h 



(1) 



with the binary entropy h(x) = —x\og2{x) — (1 — 
a;)log2(l — x). This formula provides an unconditional 
security bound under the same assumptions as in [l^ ; it 
also guarantees partial security in a more paranoid sce- 
nario, in which the QKD devices are untrusted (we shall 
come back to this issue in the conclusions). 

In this paper, we describe an entanglement-based QKD 
experiment in which we monitor the violation of the 
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FIG. 1: Orientation of different detector polarizations. Coin- 
cidences (1,1') and (2,2') are used for key generation, while 
coincidences between any of (3,4,5,6) and any of (l',2',3',4') 
will be used for testing a CHSH inequality for various settings. 



CHSH inequality and use ([T]) to quantify the degree of 
raw key compression in the privacy amplification step. 
Typically, implementations of entanglement-based QKD 



systems do not monitor Bell inequalities 
one of the first experiments 2J|, a Bell-type inequality 
was monitored, but no quantitative measure of security 
was derived from the observed violation. 

Experiment. We implement a modified Ekert91 pro- 
tocol [2^ that uses a minimal combination of three de- 
tection settings aQ,ai,aK on one side, and two distinct 
detection settings bg , bi on the other side for performing 
polarization measurements on a photon-pair in a singlet 
state l^-") = -^{IHaVb) - \VaHb)). The setting pair 
{ax, bo) corresponds to horizontal/vertical polarization, 
and should lead (in the absence of noise) to perfectly 
anti-correlated measurement results which form the raw 
key. The setting bo and the other ones are used to check 
the violation of the CHSH inequality jS*] < 2 with 

S = E{ao,bo) + Eiao,bi) + E{ai,bo) - E{ai,bi) .{2) 

The correlation coefficients E are determined from the 



number 



of coincidence events between detectors i on 



one side and j on the other side, collected during a given 
integration time T. Measurement bases are chosen such 
that a maximal value of \S\ — 2\/2 would be expected. 
Basis bi is chosen to correspond to ±45° linear polar- 
ization, and bases 6, c need to form an orthogonal set 
corresponding to ±22.5°, ±67.5° linear polarizations (see 
Fig. [!}. With that, we evaluate for example 



E{ao,bo) 



"3,1' + "4,2' + "3,2' + "4,1' 



(3) 



and the other coefficients in ^ accordingly from an en- 
semble of pair detection events. 
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FIG. 2: Experimental setup. Polarization-entangled photon 
pairs are generated via parametric down conversion pumped 
by a laser diode (LD) in a nonlinear optical crystal (BBO) 
with walk-off compensation (WP, CC) into single mode opti- 
cal fibers (SMF). A free-space optical channel for one detec- 
tor set (Bob) is realized using small telescopes on both sides 
(ST, RT). Spectral filtering is implemented with a pinhole 
(PH) which is imaged completely onto the active area of the 
photodetectors with a relay lens (R) through a spectral filter 
(F). Both parties perform polarization measurements in bases 
randomly chosen by beam splitters (B1-B3), and defined by 
properly oriented wave plates (H1-H3) in front of polarizing 
beam splitters (PBS) and photon counting detectors. Photo 
events are registered separately with time stamp units (TU) 
connected to two PC linked via a classical channel. 



The random choice of measurement bases is performed 
with a combination of polarization-independent beam 
splitters (B1-B3, see Fig. [5]), with a 50:50 splitting ratio. 
This avoids an explicit generation of a random number by 
a device. The base settings corresponding to the angles 
shown in Fig. [T] are adjusted by appropriately oriented 
half wave plates (H1-H3). 

The remaining elements of the experimental setup 
are similar to a previous experiment implementing an 
entanglement-based BB84 protocol Polarization- 
entangled photon pairs are generated in a compact diode- 
laser pumped non-coUinear type-II parametric down con- 
version process [2^ with efficient collection techniques 
into single mode optical fibers [l^, [2^ . We pump a 2 mm 
thick /3-Barium Borate (BBO) crystal at a wavelength of 
407 nm with a power of 40 mW and observe a photo co- 
incidence rate of about 18000 s~^ in passively-quenched 
silicon avalanche photodiodes directly at the source. We 
separate the two measurement devices by ~ 1.5 km in 
an urban environment, introducing a link loss of about 
3 dB caused primarily by atmospheric absorption at the 
down converted wavelength of 810 nm and transmission 
fluctuations. 

Background light suppression (at night) was accom- 
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plished using a spatial filter (PH) in the receiving tele- 
scope (acceptance range ft = 6.5 • 10~^sr) and a color 
glass filter (RG780) with a peak transmission of ^ 90% 
for the down-converted light at 810 nm. 

Correlated photons are identified by recording their 
time of arrival at each detector and running a cross cor- 
relation of the timing information on both sides (similar 



to the scheme in [IJ]). The virtual coincidence window 



defined in software was 3.75 ns, and we monitored the 
accidental coincidences in an equally wide time window 
offset by 20 ns. Detector time delay compensation was 
adjusted to better than 0.5 ns to avoid leakage through a 
classical timing channel [1^. 

The experimental results from one 9.5 hour run are 
shown in Fig. [3] In this interval, we observe a small drop 
of the coincidence rate due to an alignment drift in the 
optical hnk. Accidental coincidences were about 0.5% of 
the coincidences from down-converted photon pairs. 

Half of the identified photon pairs were seen by detec- 
tors (3,4,5,6) paired with (l',2',3',4'), which were used to 
evaluate the violation of About a quarter of the pairs 
in detector combinations (1,2) with (l',2') contributed to 
the raw key, while the residual quarter of pairs in com- 
binations (1,2) with (3', 4') were discarded. Detectors 
(1,2,1', 2') were adjusted to coincide with the natural axes 
of the down conversion crystal to keep the error rate on 
the raw key as small as possible. 

Error correction following a modified CASCADE pro- 
tocol (soj l was performed in real time on packets of at 
least 10000 raw bits for a targeted final bit error ratio 
of 10""'^^. The corresponding quantum bit error ratio 
(QBER) was extracted out of this procedure (Fig. [Sb). 
The combined correlation value S was extracted via ^ 
for that block of raw key, and stayed at around 2.5 over 
the whole measurement time (Fig. [5};). This is not a 
particularly high value, and we suspect a broad optical 
spectrum in the blue pump diode as a reason for this 
problem. This is compatible with lower polarization cor- 
relation in the ±45° basis due to a residual distinguisha- 
bility between the two decay paths in the SPDC process. 
However, it serves as a typical model for an eavesdrop- 
ping attempt e.g. by a partial intercept-resend attack in 
the H/V basis. While such an attack is not revealed in 
the QBER in this protocol, it clearly shows in a reduction 
of S from the maximally expected value of 2^2- 

The average information leakage I per raw bit to an 
eavesdropper was estimated for each block following ([1]). 
Together with the revealed bits in the error correction 
procedure (and not assuming that any errors are due to 
intrinsic detector noise), we can then establish the secret 
key fraction Alice and Bob can extract out of the privacy 
amplification hashing procedure from a given raw key 
block. The result over time is shown in Fig. resulting 
in an average final key rate of around 300 bit s~^ or about 
10^ bit of error-free secret key. 

The estimation of the eavesdropper knowledge is appli- 
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FIG. 3; Experimental results in a key distribution experiment 
implementing an EkertQl protocol, (a) shows total (upper 
trace) and accidental (lower trace) detected coincidence rates 
between Alice and Bob, (b) the error ration in the raw key, 
(c) the degree of violation of a CHSH-type Bell inequality, (d) 
the final key rate after error correction and privacy amplifica- 
tion. The experiment was terminated by a storm misaligning 
a telescope of the optical link at 5 am. 
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cable strictly only for an infinitely large number of bits; 
recent work on the security of finite length keys implies 
that the privacy amp lification should be carried out over 
large ensembles 31, 32, [s^- For the protocol studied 
here, a finite-key bound has been presented in Ref. [s^l- 
By performing privacy amplification on blocks of rt = 10^ 
bits of the raw key, the extractable secure key is around 
half of the asymptotic value js^l . 

Conclusion and perspectives. We have demonstrated a 
free space implementation of a modified Ekert91 proto- 
col. The security of the key distilled was derived from the 
violation of the CHSH inequality. This ensured that the 
key was distributed not by some arbitrary random num- 
ber generator, but with the non-local correlations shared 
by entangled photon-pairs. 

Using EkertQl, the authorized parties can give up con- 
trol over the photon source. Aci'n et al. [2lj showed that 
the CHSH violation is in principle sufficient to decide the 
security (against collective attacks) of a distributed key, 
even if the measurement apparatus is not trusted. Unfor- 
tunately, such a scheme is not yet experimentally feasible 
because of the stringent requirement it places on detector 
efficiencies 



21, 35 



A final point must be made about the random choice 
generator. Our implementation leaves this choice to the 
beam splitter Bl in Fig. [21 which is accessible from 
the quantum channel. We are then assuming that the 
eavesdropper cannot change the beam splitter's behav- 
ior. This is reasonable; however, it makes our setup 
fall outside the device-independent scenario, even in the 
lossless regime. In particular, in that scenario, one can 
construct a situation in which BB84 would not be se- 
cure at all [3^ because it is conceivable that different 
states are sent to the different measurement devices; but 
this is excluded for a well-behaved beam-splitter, which 
is precisely our assumption. Device-independent secu- 
rity requires the choice to be made on degrees of freedom 
independent of those accessible to the eavesdropper. 
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